Licensing is clear, dependencies are minimal, and the repository is maintained by two contributors. Workflow references are unpinned and no security policy is published.
62%
Total Score
100
63
67
Only two releases were published, both in April 2021, with no release in over five years. Recent repository activity partly offsets the stale registry history but does not show that new package versions are being published.
The repository name does not exactly match the package name and its README does not mention the package, creating some uncertainty about package-to-repository correspondence. The matching WPZOOM organization owner provides limited compensation.
The linked repository has no published security policy, which reduces transparency for reporting and handling security issues, although this is not evidence of an unsafe release by itself.
Both workflows were analyzed cleanly with no untrusted checkouts, script injection, or high-confidence findings, but all 5 action references are unpinned. Missing top-level permissions blocks are acceptable here because no broad write permissions were observed.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.